Classifications

• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
  • G07C5/00—Registering or indicating the working of vehicles
  • G07C5/008—Registering or indicating the working of vehicles communicating information to a remotely located station
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/60—Protecting data
  • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
  • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
  • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
  • G07C5/00—Registering or indicating the working of vehicles
  • G07C5/08—Registering or indicating performance data other than driving, working, idle, or waiting time, with or without registering driving, working, idle or waiting time
  • G07C5/0841—Registering performance data
  • G07C5/085—Registering performance data using electronic data carriers
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
  • H04W4/02—Services making use of location information
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
  • H04W4/30—Services specially adapted for particular environments, situations or purposes
  • H04W4/40—Services specially adapted for particular environments, situations or purposes for vehicles, e.g. vehicle-to-pedestrians [V2P]
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
  • H04W4/60—Subscription-based services using application servers or record carriers, e.g. SIM application toolkits

Definitions

• the present disclosure relates to data security, and more particularly, to a scheme for securely protecting the privacy of operator data available via a vehicular control architecture.
• the technology that controls the operation of automobiles is moving from traditional mechanical-based systems to electronic control. These electronic controls systems not only control the operation of modern cars, but may also be able to store data related to operation. For example, automobile speed, force reaction due to cornering, operator system access (e.g., turn signal use, entertainment system use, cellular communication system use, etc.) may all be tracked and recorded by the car' s control system. Currently this information may be used principally for vehicle maintenance. However, soon it may be possible to identify the vehicle operator and/or passengers at the time vehicular operational data is recorded. This capability may desirable to various entities including, for example, insurance companies, governmental bodies (e.g., law enforcement, rule-making bodies, etc.), organizations that publish vehicle- related statistics, etc. While societal benefits may exist for making vehicular data available, a scenario wherein operator/vehicle data is freely disseminated to parties (known or unknown to a vehicle operator) introduces substantial privacy concerns that may impact its acceptance.
• FIG. 1 illustrates an example device configured for secure vehicular data management with enhanced privacy in accordance with at least one embodiment of the present disclosure
• FIG. 2 illustrates an example configuration for a device in accordance with at least one embodiment of the present disclosure
• FIG. 3 illustrates example implementation and operation of secure vehicular data management with enhanced privacy in accordance with at least one embodiment of the present disclosure
• FIG. 4 illustrates example operations for secure vehicular data management with enhanced privacy in accordance with at least one embodiment of the present disclosure.
• a vehicle may comprise at least a vehicular control architecture (VCA) for controlling operation of the vehicle and a device.
• VCA vehicular control architecture
• the VCA may record operational data identifying at least one vehicle operator and vehicular operational data recorded during operation of the vehicle by the at least one vehicle operator.
• the device may include at least communication module and a privacy enforcement module (PEM) secured in a trusted execution environment (TEE).
• PEM privacy enforcement module
• TEE trusted execution environment
• the PEM may receive the operational data from the VCA via the communication module, may generate filtered data by filtering the operational data based on privacy settings and may then cause the filtered data to be transmitted via the communication module.
• the filtered data may be transmitted to at least one data consumer coupled to the VCA, located outside of the vehicle, etc.
• the privacy settings may be configured in the PEM by the at least one operator.
• a device may comprise, for example, a communication module and a trusted execution environment including at least a privacy enforcement module.
• the communication module may be to communicate with at least a vehicular control architecture.
• the vehicular control architecture may be for controlling operation of a vehicle in which the device is situated.
• the privacy enforcement module may be to receive operational data from the vehicular control architecture via the communication module and to generate filtered data by filtering the operational data based on privacy settings.
• the privacy enforcement module may further be to cause the filtered data to be transmitted by the communication module.
• the communication module may further be to communicate with at least one data consumer that may be, for example, situated outside of the vehicle.
• the privacy enforcement module may further be to receive a request for the filtered data from the at least one data consumer via the communication module.
• the environment may be a secure workspace in which only known-good programs execute, the privacy enforcement module being a known-good program.
• the privacy enforcement module being to generate filtered data may comprise the privacy enforcement module being to remove at least a portion of the operational data from the filtered data based on the privacy settings.
• the operational data may comprise data identifying at least one vehicle operator and vehicular operational data recorded during operation of the vehicle by the at least one vehicle operator.
• the privacy enforcement module being to generate filtered data may comprise the privacy enforcement module being to replace the data identifying the at least one vehicle operator with coded identification data or to alter the data identifying the at least one vehicle operator to render the at least one vehicle operator anonymous based on the privacy settings.
• the vehicular control architecture may comprise a plurality of controllers for controlling different areas of vehicular operation.
• the plurality of controllers may communicate using at least one of a bus communication architecture or an optical mesh communication architecture.
• At least one controller in the plurality of controllers may be to control a user interface in the vehicle for allowing the privacy settings to be configured.
• An example method consistent with embodiments of the present disclosure may comprise receiving operational data in a device from a vehicular control architecture for controlling a vehicle in which the device is situated, generating filtered data by filtering the operational data based on privacy settings, the filtered data being generated by a privacy enforcement module included in a trusted execution environment in the device and causing the filtered data to be transmitted.
• FIG. 1 illustrates an example device configured for secure vehicular data management with enhanced privacy in accordance with at least one embodiment of the present disclosure.
• vehicle 100 may be described as road-going transportation (e.g., motorcycle, car, truck, bus etc.). However, vehicle 100 may be another type of vehicle such as, but not limited to, a rail-going vehicle, aquatic vehicle, aircraft, tracked vehicle, etc.
• Vehicle 100 may include, for example, device 102 and vehicular control architecture (VCA) 104.
• VCA vehicular control architecture
• device 102 may filter operational data received from VCA 104 to avoid providing information that may be deemed private to data consumer 106.
• Device 102 may be original equipment installed in vehicle 100 during manufacture, may be installed as aftermarket equipment, may be removable and applicable to other uses, etc.
• a removable device 102 may only operate in a manner consistent with functionality such as described herein when combined with vehicle 100.
• removable devices 102 may include, but are not limited to, a mobile communication device such as a cellular handset or a smartphone based on the Android® OS, iOS®, Windows® OS, Blackberry® OS, Palm® OS, Symbian® OS, etc., a mobile computing device such as a tablet computer like an iPad®, Surface®, Galaxy Tab®, Kindle Fire®, etc., an Ultrabook® including a low-power chipset manufactured by Intel Corporation, a netbook, a notebook, a laptop, a palmtop, etc.
• VCA 104 may comprise at least one controller to control operations in vehicle 100.
• vehicles like automobiles may comprise a plurality of controllers for controlling different aspects of vehicular operation.
• individual controllers may be used to control engine operation, drivetrain shifting, suspension adjustment, heating, ventilating and air conditioning (HVAC) operation, driver interface operation, entertainment and navigation systems, security, vehicle condition monitoring and warning systems, etc.
• HVAC heating, ventilating and air conditioning
• controllers may also store information regarding vehicular operation.
• controllers may store vehicle location, speed, acceleration, suspension changes (e.g., when the vehicle is cornering, G-force and/or body angle during cornering, etc.), user actions (e.g., turn signal operation, radio operation, communication system operation, etc.), etc.
• the operator of the vehicle may also be determined by a controller in VCA 104.
• an operator may be identified by electronics in the key used to start vehicle 100, by codes keyed into a user interface to deactivate security in vehicle 100, by biometric identification (e.g., by voice identification, fingerprint identification, facial recognition, etc.).
• VCA 104 may be able to store the identification of the vehicle operator along with vehicular operational data recorded when the identified vehicle operator is operating vehicle 100.
• Data consumer 106 may include at least one entity to receive filtered data from device 102.
• Examples of data consumers 106 may include a mechanic (e.g., via a device physically connected to vehicle 100), remotely situated entities that collect vehicular operational data, etc.
• device 102 may interact with equipment associated with the remote entity via wireless communication.
• the equipment of the remote entity may include at least one computing device (e.g., a server) accessible via a WAN like the Internet (e.g., in a cloud-based computing architecture).
• TEE 108 may be a secure workspace in which known-good programs (e.g., PEM 110) may execute, confidential information may be stored in a secure manner, etc.
• PEM 110 privacy enforcement module
• TEE 108 may employ Secure Enclave (SE) technology developed by the Intel Corporation. SE may provide a safe and hardware-encrypted computation and storage area inside of system memory, the contents of which cannot be deciphered by privileged code or even through the application of hardware probes to memory bus.
• SE Secure Enclave
• SE may provide a safe and hardware-encrypted computation and storage area inside of system memory, the contents of which cannot be deciphered by privileged code or even through the application of hardware probes to memory bus.
• SE may be visualized as a virtual safe for protecting applications, data, etc.
• An application developer may specify the memory region that must be protected, which creates the safe. At this point there is a safe available, but nothing of value is stored inside.
• the application developer may then place code into the protected memory region and may initialize any necessary data. At this point the code and data have been placed inside of the safe, but nothing is secret yet as anyone may have observed what was placed into the safe because "the safe door" is still open.
• the application may then initialize the SE, which may be considered as the equivalent of closing and locking the door of the safe. From this point forward the enclave code may execute only inside of the safe and running code inside this enclave may generate secure keys (e.g., protected data). Protected data values cannot be observed outside of the SE, and thus, the code and data is inaccessible outside of the SE.
• TEE 108 resides within an SE
• the identity of programs may be signed and stored inside each program.
• the processor verifies that the measurement of the program (e.g., as computed by the processor) is identical to the measurement previously embedded inside the program.
• the signature used to sign the embedded measurement is also verifiable because the processor is provided with a public key used to verify the signature at program load time. This way malware can't tamper with the program without also altering its verifiable measurement. Malware also cannot spoof the signature because the signing key is secure with the program's author. Thus, the software may not be read, written to or altered by any malware.
• TEE 108 data may also be protected in TEE 108.
• known-good programs in TEE 108 may encrypt data such as keys, passwords, licenses, etc. so that only verified good programs may decrypt this information.
• TEE 108 While only one TEE 108 is disclosed in device 102, it is also possible for a plurality of TEEs 108 to exist. The use of a plurality of TEEs 108 may increase security in device 102 in that if one TEE 108 is compromised the security of the remaining separate TEEs 108 remains intact.
• PEM 110 may be to filter operational data received from VCA 104 based on privacy settings prior to transmission of the operational data (e.g., to data consumer 106).
• vehicle 100 may record very comprehensive operational data about an operator of vehicle 100 and the general operation of vehicle 100 while driven by the operator. This operational data may include, for example, the identity of the operator, locations where the operator drove vehicle 100, how vehicle 100 was driven, what occurred while vehicle 100 was driven, etc. The operator of vehicle 100 may not want to make all of this operational data available to data consumer 106 due to privacy concerns, safety/security concerns, etc.
• PEM 110 may be a known-good program within TEE 108, and thus, TEE 108 may protect PEM 110 from being accessed, changed, corrupted, etc. For example, people with technical skill may attempt to access PEM 110 to alter the privacy settings to allow personal information to be provided to data consumer 106.
• the privacy settings may be configured during the manufacture of the vehicle, by an operator of the vehicle via a user interface in vehicle 100, etc.
• the privacy settings may instruct PEM 110 to generate filtered data by removing and/or changing portions of the operational data received from VCA 104.
• PEM 110 may replace occurrences of the operator's actual identity (e.g., name, address, phone, etc.) with encoded information.
• Examples of encoded information may include insurance account numbers, service subscriber numbers, vehicle identification numbers (VIN), etc.
• PEM 110 may simply remove personal information as indicated by the privacy settings. For example, PEM 110 may remove one or more of location data, speed data, data about the actions performed by the operator in vehicle 100, etc.
• FIG. 2 illustrates an example configuration for a device in accordance with at least one embodiment of the present disclosure.
• device 102' may be able to perform example functionality such as disclosed in FIG. 1.
• device 102' is meant only as an example of equipment usable in embodiments consistent with the present disclosure, and is not meant to limit these various embodiments to any particular manner of implementation.
• Device 102' may comprise system module 200 configured to manage device operations.
• System module 200 may include, for example, processing module 202, memory module 204, power module 206, user interface module 208 and communication interface module 210.
• Device 102' may also include communication module 212 and TEE 108'.
• communication module 212 and TEE 108' have been shown separately from system module 200, the example implementation of device 102' has been provided merely for the sake of explanation herein. Some or all of the functionality associated with communication module 212 and/or TEE 108' may also be incorporated within system module 200.
• processing module 202 may comprise one or more processors situated in separate components, or alternatively, may comprise one or more processing cores embodied in a single component (e.g., in a System-on-a-Chip (SoC) configuration) and any processor-related support circuitry (e.g., bridging interfaces, etc.).
• Example processors may include, but are not limited to, various x86-based microprocessors available from the Intel Corporation including those in the Pentium, Xeon, Itanium, Celeron, Atom, Core i-series product families, Advanced RISC (e.g., Reduced Instruction Set Computing) Machine or "ARM" processors, etc.
• support circuitry may include chipsets (e.g.,
• processing module 202 may interact with other system components that may be operating at different speeds, on different buses, etc. in device 102' .
• Some or all of the functionality commonly associated with the support circuitry may also be included in the same physical package as the processor (e.g., such as in the Sandy Bridge family of processors available from the Intel Corporation).
• Processing module 202 may be configured to execute various instructions in device 102'. Instructions may include program code configured to cause processing module 202 to perform activities related to reading data, writing data, processing data, formulating data, converting data, transforming data, etc. Information (e.g., instructions, data, etc.) may be stored in memory module 204.
• Memory module 204 may comprise random access memory (RAM) or read-only memory (ROM) in a fixed or removable format. RAM may include memory configured to hold information during the operation of device 102' such as, for example, static RAM (SRAM) or Dynamic RAM (DRAM).
• SRAM static RAM
• DRAM Dynamic RAM
• ROM may include memories such as Bios or Unified Extensible Firmware Interface (UEFI) memory configured to provide instructions when device 102' activates, programmable memories such as electronic programmable ROMs (EPROMS), Flash, etc.
• programmable memories such as electronic programmable ROMs (EPROMS), Flash, etc.
• Other fixed and/or removable memory may include magnetic memories such as, for example, floppy disks, hard drives, etc., electronic memories such as solid state flash memory (e.g., embedded multimedia card (eMMC), etc.), removable memory cards or sticks (e.g., micro storage device (uSD), USB, etc.), optical memories such as compact disc-based ROM (CD-ROM), etc.
• solid state flash memory e.g., embedded multimedia card (eMMC), etc.
• uSD micro storage device
• USB etc.
• CD-ROM compact disc-based ROM
• Power module 206 may include internal power sources (e.g., a battery) and/or external power sources (e.g., electromechanical or solar generator, power grid, fuel cell, etc.), and related circuitry configured to supply device 102' with the power needed to operate.
• internal power sources e.g., a battery
• external power sources e.g., electromechanical or solar generator, power grid, fuel cell, etc.
• related circuitry configured to supply device 102' with the power needed to operate.
• User interface module 208 may be optional based on, for example, the type of device 102'. For example, user interface module 208 may not be necessary if device 102' is factory installed equipment in vehicle 100, while a removable device 102' (e.g., a smart phone) may include user interface module 208.
• User interface module 208 may include equipment and/or software to allow users to interact with device 102' such as, for example, various input mechanisms (e.g., microphones, switches, buttons, knobs, keyboards, speakers, touch- sensitive surfaces, one or more sensors configured to capture images and/or sense proximity, distance, motion, gestures, orientation, etc.) and various output mechanisms (e.g., speakers, displays, lighted/flashing indicators, electromechanical components for vibration, motion, etc.).
• the equipment in user interface module 208 may be incorporated within device 102' and/or may be coupled to device 102' via a wired or wireless communication medium.
• Communication interface module 210 may be configured to handle packet routing and other control functions for communication module 212, which may include resources configured to support wired and/or wireless communications.
• Wired communications may include serial and parallel wired mediums such as, for example, Ethernet, Universal Serial Bus (USB), Firewire, Digital Video Interface (DVI), High-Definition Multimedia Interface (HDMI), etc.
• Wireless communications may include, for example, close-proximity wireless mediums (e.g., radio frequency (RF) such as based on the Near Field Communications (NFC) standard, infrared (IR), optical character recognition (OCR), magnetic character sensing, etc.), short-range wireless mediums (e.g., Bluetooth, WLAN, Wi-Fi, etc.) and long range wireless mediums (e.g., cellular wide-area radio communication technology, satellite-based communications, etc.).
• RF radio frequency
• NFC Near Field Communications
• IR infrared
• OCR optical character recognition
• magnetic character sensing etc.
• short-range wireless mediums e.g., Bluetooth, WLAN, Wi-Fi, etc.
• long range wireless mediums e.g., cellular wide-area radio communication technology, satellite-based communications, etc.
• communication interface module 210 may be configured to prevent wireless communications that are active in communication module 212 from interfering with each other. In performing this function, communication interface module 210 may schedule activities for communication module 212
• TEE 108' may be configured to interact with at least user processing module 202, memory module 204 and communication module 212.
• PEM 110' operating within TEE 108' may receive a request for operational data via communication module 212 (e.g., from data consumer 106) and may then receive operational data from VCA 104 via communication module 212.
• TEE 108' may rely upon processing module 202 and/or memory module 206 for generating filtered data from the operational data.
• PEM 110' may cause communication module 212 to transmit the filtered data from device 102' (e.g., to data consumer 106).
• FIG. 3 illustrates example implementation and operation of secure vehicular data management with enhanced privacy in accordance with at least one embodiment of the present disclosure.
• VCA 104' has been illustrated as a plurality of vehicular control units (VCUs) comprising VCUl, VCU2, VCU3, VCU4, VCU5, VCU6, VCU and VCU 8 (e.g., collectively, VCUl ...8) that may interact on bus structure 300. While eight VCUl ...8 have been illustrated in FIG. 3, more or less VCUs may be employed depending on the complexity of vehicle 100' (e.g., the number of automated systems in vehicle 100'), etc. VCUl ...8 may each control a different area of operation in vehicle 100' .
• VCUl ...8 may each control a different area of operation in vehicle 100' .
• Bus structure 300 may be a control area network bus (CAN bus), an automotive optical control mesh, or any other type of network that enables communication between VCUl ...8 in vehicle 100', as well as with PEM 110.
• communication module 212 as described with respect to device 102' may comprise an interface so that PEM 110 may communicate on bus 300, or alternatively, device 102 may comprise a separate interface for communicating on bus 300.
• User interface 302 may be a user interface accessible to operators of vehicle 100'.
• An example of user interface 302 may include a navigation/communication/entertainment system in vehicle 100'.
• User interface 302 may be supported by VCUl.
• Operators of vehicle 100' may interact with user interface 302 to configure desired privacy settings 306 in PEM 110.
• the interaction with user interface 302 may configure the privacy settings in VCUl, which may transmit the privacy settings to PEM 110 via bus 300 as shown at 304.
• device 102 is removable (e.g. a smart phone, mobile computing device, etc.), an operator may interact directly with removable device 102 via user interface module 208 to configure privacy settings 306.
• an operator may be identified by a VCU (e.g., VCU4) upon entering vehicle 100', deactivating vehicular security, starting vehicle 100', etc. as shown at 308.
• VCUs may store operational data and then provide the operational data to PEM 110 via bus 300 as shown at 310.
• the operational data may be provided, for example, periodically, upon request, upon the occurrence of events (e.g., service alerts), etc.
• PEM 110 may then employ privacy settings 306 to generate filtered data by filtering the operational data. Filtering may include changing or removing some of the operational data based on the privacy settings.
• the filtered data may then be transmitted to data consumers 106A', 106B' and 106C (collectively 106A...C) as shown at 314.
• Example data consumers may include, but are not limited to, insurance company 106A', personal cloud service 106B' (e.g., remotely located data storage accessible via a WAN like the Internet), vehicular data accumulator 106C (e.g., a private or governmental agency charged with determining driving laws), etc. While three data consumers 106A...C have been disclosed in FIG. 3, more or less data consumers 106 may exist depending on the parties interested in operational data.
• FIG. 4 illustrates example operations secure vehicular data management with enhanced privacy in accordance with at least one embodiment of the present disclosure.
• privacy settings may be configured in a device within a vehicle. For example, an operator may configure the privacy settings via a user interface provided by a navigation, entertainment and/or communication interface in the vehicle.
• a requirement for operational data may then be triggered in operation 402. For example, a request may be received from a data consumer (e.g., a pull configuration), a periodic or event-based requirement to transmit operational data may be triggered (e.g., a push configuration), etc.
• the data to be transmitted per the requirement may be evaluated in view of the privacy settings. More specifically, the composition of the operational data to be transmitted may be reviewed based on the previously configured privacy settings to determine if data filtering is required.
• the filtered data may be transmitted in operation 412 (e.g., to at least one data consumer).
• new requirements for operational data may cause operations to return to operation 402, while a new operator using the vehicle may cause operations to resume at 400 for new privacy settings to be configured.
• FIG. 4 illustrates operations according to an embodiment, it is to be understood that not all of the operations depicted in FIG. 4 are necessary for other embodiments.
• the phrases "at least one of A, B or C" can mean A; B; C; A and B; A and C; B and C; or A, B and C.
• module may refer to software, firmware and/or circuitry configured to perform any of the aforementioned operations.
• Circuitry may comprise, for example, singly or in any combination, hardwired circuitry, programmable circuitry such as computer processors comprising one or more individual instruction processing cores, state machine circuitry, and/or firmware that stores instructions executed by programmable circuitry.
• the modules may, collectively or individually, be embodied as circuitry that forms part of a larger system, for example, an integrated circuit (IC), system on- chip (SoC), desktop computers, laptop computers, tablet computers, servers, smartphones, etc.
• IC integrated circuit
• SoC system on- chip
• any of the operations described herein may be implemented in a system that includes one or more storage mediums (e.g., non-transitory storage mediums) having stored thereon, individually or in combination, instructions that when executed by one or more processors perform the methods.
• the processor may include, for example, a server CPU, a mobile device CPU, and/or other programmable circuitry. Also, it is intended that operations described herein may be distributed across a plurality of physical devices, such as processing structures at more than one different physical location.
• the storage medium may include any type of tangible medium, for example, any type of disk including hard disks, floppy disks, optical disks, compact disk read-only memories (CD-ROMs), compact disk rewritables (CD- RWs), and magneto-optical disks, semiconductor devices such as read-only memories (ROMs), random access memories (RAMs) such as dynamic and static RAMs, erasable programmable read-only memories (EPROMs), electrically erasable programmable read-only memories (EEPROMs), flash memories, Solid State Disks (SSDs), embedded multimedia cards (eMMCs), secure digital input/output (SDIO) cards, magnetic or optical cards, or any type of media suitable for storing electronic instructions.
• ROMs read-only memories
• RAMs random access memories
• EPROMs erasable programmable read-only memories
• EEPROMs electrically erasable programmable read-only memories
• flash memories Solid State Disks (SSDs), embedded multimedia cards (eMMC
• a vehicle may comprise at least a vehicular control architecture (VCA) for controlling operation of the vehicle and a device.
• VCA vehicular control architecture
• the VCA may record operational data identifying at least one vehicle operator and vehicular operational data recorded during operation of the vehicle by the at least one vehicle operator.
• the device may include at least a communication module and a trusted execution environment (TEE) including a privacy enforcement module (PEM).
• TEE trusted execution environment
• PEM privacy enforcement module
• the PEM may receive the operational data from the VCA via the communication module, may generate filtered data by filtering the operational data based on privacy settings and may cause the filtered data to be transmitted via the communication module.
• the filtered data may be transmitted to at least one data consumer.
• the privacy settings may be configured in the PEM by the at least one operator.
• the following examples pertain to further embodiments.
• the following examples of the present disclosure may comprise subject material such as a device, a method, at least one machine-readable medium for storing instructions that when executed cause a machine to perform acts based on the method, means for performing acts based on the method and/or a system for secure vehicular data management with enhanced privacy, as provided below.
• Example 1
• a device comprising a communication module to communicate with at least a vehicular control architecture for controlling operation of a vehicle in which the device is situated and a trusted execution environment including a privacy enforcement module to receive operational data from the vehicular control architecture via the communication module, generate filtered data by filtering the operational data based on privacy settings and cause the filtered data to be transmitted by the
• This example includes the elements of example 1, wherein the communication module is further to communicate with at least one data consumer.
• This example includes the elements of example 2, wherein the at least one data consumer is situated outside of the vehicle.
• Example 4 This example includes the elements of example 3, wherein the communication with the at least one data consumer is conducted via a wired interface physically coupled to the vehicle or via a wireless link.
• This example includes the elements of any of examples 3 to 4, wherein the at least one data consumer comprises at least one of a mechanic, an insurance company, a personal cloud service or a vehicular data accumulator.
• This example includes the elements of any of examples 2 to 5, wherein the privacy enforcement module is further to receive a request for the filtered data from the at least one data consumer via the communication module.
• This example includes the elements of any of examples 1 to 6, wherein the trusted execution environment is a secure workspace in which only known-good programs execute, the privacy enforcement module being a known-good program.
• This example includes the elements of example 7, wherein the trusted execution environment includes at least one secure enclave in the device.
• This example includes the elements of any of examples 1 to 8, wherein the privacy enforcement module being to generate filtered data comprises the privacy enforcement module being to remove at least a portion of the operational data from the filtered data based on the privacy settings.
• Example 11 includes the elements of any of examples 1 to 9, wherein the operational data comprises data identifying at least one vehicle operator and vehicular operational data recorded during operation of the vehicle by the at least one vehicle operator.
• Example 11 the operational data comprises data identifying at least one vehicle operator and vehicular operational data recorded during operation of the vehicle by the at least one vehicle operator.
• This example includes the elements of example 10, wherein the privacy enforcement module being to generate filtered data comprises the privacy enforcement module being to replace the data identifying the at least one vehicle operator with coded identification data or to alter the data identifying the at least one vehicle operator to render the at least one vehicle operator anonymous based on the privacy settings.
• Example 12 This example includes the elements of any of examples 1 to 11, wherein the vehicular control architecture comprises a plurality of controllers for controlling different areas of vehicular operation.
• This example includes the elements of example 12, wherein the plurality of controllers communicate using a bus communication architecture.
• This example includes the elements of any of examples 12 to 13, wherein the plurality of controllers communicate using an optical mesh communication architecture.
• This example includes the elements of any of examples 12 to 14, wherein at least one controller in the plurality of controllers is to control a user interface in the vehicle for allowing the privacy settings to be configured.
• This example includes the elements of any of examples 1 to 15, wherein the device is removable from the vehicle.
• This example includes the elements of example 16, wherein the device is a mobile communication device.
• This example includes the elements of any of examples 16 to 17, wherein the device is a mobile computing device.
• This example includes the elements of any of examples 1 to 18, wherein the vehicular control architecture comprises a plurality of controllers for controlling different areas of vehicular operation, at least one controller in the plurality of controllers being to control a user interface in the vehicle for allowing the privacy settings to be configured.
• a method comprising receiving operational data in a device from a vehicular control architecture for controlling a vehicle in which the device is situated, generating filtered data by filtering the operational data based on privacy settings, the filtered data being generated by a privacy enforcement module included in a trusted execution environment in the device and causing the filtered data to be transmitted.
• This example includes the elements of example 20, wherein causing the filtered data to be transmitted comprises causing the filtered data to be transmitted to at least one data consumer.
• This example includes the elements of example 21, wherein the at least one data consumer is situated outside of the vehicle.
• This example includes the elements of example 22, wherein the communication with the at least one data consumer is conducted via a wired interface physically coupled to the vehicle or via a wireless link.
• This example includes the elements of any of examples 22 to 23, wherein the at least one data consumer comprises at least one of a mechanic, an insurance company, a personal cloud service or a vehicular data accumulator.
• This example includes the elements of any of examples 20 to 24, and further comprises receiving a request for the filtered data from the at least one data consumer.
• This example includes the elements of any of examples 20 to 25, wherein the trusted execution environment is a secure workspace in which only known-good programs execute, the privacy enforcement module being a known-good program.
• This example includes the elements of example 26, wherein the trusted execution environment includes at least one secure enclave in the device.
• This example includes the elements of any of examples 20 to 27, wherein generating filtered data comprises removing at least a portion of the operational data from the filtered data based on the privacy settings.
• Example 30 This example includes the elements of example 29, wherein generating filtered data comprises replacing the data identifying the at least one vehicle operator with coded identification data or altering the data identifying the at least one vehicle operator to render the at least one vehicle operator anonymous based on the privacy settings.
• This example includes the elements of any of examples 20 to 30, further comprising providing a user interface in the vehicle for allowing the privacy settings to be configured.
• Example 32
• Example 33 there is provided a system including at least one device, the system being arranged to perform the method of any of the above examples 20 to 31.
• Example 33
• At least one machine readable medium comprising a plurality of instructions that, in response to be being executed on a computing device, cause the computing device to carry out the method according to any of the above examples 20 to 31.
• At least one device configured for secure vehicular data management with enhanced privacy, the device being arranged to perform the method of any of the above examples 20 to 31.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Physics & Mathematics (AREA)
• General Physics & Mathematics (AREA)
• Computer Security & Cryptography (AREA)
• General Health & Medical Sciences (AREA)
• Bioethics (AREA)
• Health & Medical Sciences (AREA)
• Theoretical Computer Science (AREA)
• Medical Informatics (AREA)
• Databases & Information Systems (AREA)
• Computer Hardware Design (AREA)
• Software Systems (AREA)
• General Engineering & Computer Science (AREA)
• Storage Device Security (AREA)
• Traffic Control Systems (AREA)
• Mobile Radio Communication Systems (AREA)

Priority Applications (7)

Applications Claiming Priority (1)

Related Child Applications (2)

Publications (1)

Family

ID=53400606

Family Applications (1)

Country Status (5)

Cited By (1)

Families Citing this family (25)

Citations (8)

Family Cites Families (7)

• 2013
  • 2013-12-19 CN CN201910173771.3A patent/CN109890004B/zh active Active
  • 2013-12-19 EP EP13899568.3A patent/EP3084676B1/de active Active
  • 2013-12-19 WO PCT/US2013/076573 patent/WO2015094287A1/en active Application Filing
  • 2013-12-19 US US14/361,516 patent/US9953467B2/en active Active
  • 2013-12-19 CN CN201380081044.5A patent/CN105745665B/zh active Active
  • 2013-12-19 KR KR1020167019167A patent/KR101861455B1/ko active IP Right Grant
• 2018
  • 2018-03-22 US US15/928,557 patent/US20180218548A1/en not_active Abandoned

Patent Citations (8)

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events